Back to overview

CVE-2026-21575

HIGH
7.1
CVSS 3.0
Description
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.13 See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives). This vulnerability was reported via our Bug Bounty program.

Metadata

CVE ID
CVE-2026-21575
State
PUBLISHED
Assigner
atlassian
Reserved
2026-01-01 00:00 UTC
Published
2026-07-21 17:00 UTC
Last updated
2026-07-24 03:55 UTC
Primary CWE
CWE-94
CWE-94 Improper Control of Generation of Code ('Code Injecti…
Vendor / Product
Atlassian / Sourcetree for Mac
Sources
cve.org  ·  NVD

Severity & Metrics

7.1 HIGH CVSS 3.0
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Atlassian Sourcetree for Mac — All versions from 3.4.11 to 3.4.12 inclusive, All versions from 3.4.13
Weakness (CWE)
CWESourceDescription
— cna RCE (Remote Code Execution)
CWE-94 adp CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.1 HIGH 3.0 cna CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
References (2)
Back to overview